moto-fogorow
Moto g24 bootloader unlock ideas #1
Replies: 12 comments 94 replies
-
|
I think for this @R0rt1z2 can help us better finding an exploit. I verified that g24 lk doesn't require any key to unlock, but it checks for Secure Boot it seems. This is something that has to be studied with mtkclient, logs and decompilation, hoping that is possible to flash seccfg with mtkclient.
|
Beta Was this translation helpful? Give feedback.
-
Hope for an exploit tbh. We'll need to write some documentation after we conclude stuff for g23, like TWRP. At least, g24 doesn't require a key to unlock, which is slightly better because we wouldn't have to find out how to generate the key But we would need to figure how to check for secure boot. |
Beta Was this translation helpful? Give feedback.
-
|
Yea it is slightly better but making an exploit is kind of harder |
Beta Was this translation helpful? Give feedback.
-
I know, but from the experience we've got with g23, I'd say this is the only option. |
Beta Was this translation helpful? Give feedback.
-
|
I suppose |
Beta Was this translation helpful? Give feedback.
-
If only there weren't the secure boot check, we would only need to run "fastboot flashing unlock" and the phone would unlock, imagine how lazy they were to block it |
Beta Was this translation helpful? Give feedback.
-
|
Empty and writable partitions of G24. (Didn't test writing the userdata.)
|
Beta Was this translation helpful? Give feedback.
-
Tbf, that's a good thing, especially because to write preloader with mtkclient you need to specify the parttype, so at least we're sure we can avoid other people bricking the preloader with mtkclient 😅 |
Beta Was this translation helpful? Give feedback.
-
|
Interesting enough, elabel here is not writable (with g23 is possible), and there's no proinfo partition? |
Beta Was this translation helpful? Give feedback.
-
|
I need to find out how to use the other DA file, maybe that one has access to more partitions or to other commands like in our case with PL_NO_CERT and MT6768_USER |
Beta Was this translation helpful? Give feedback.
-
|
I don't know where to look for the DA SLA signature though.. I was lucky enough to find the one in the SLA_CHALLENGE dll, but what about this one? 🤔 @cxzstuff could you try g24 spft with the other DA file (the one without dl_forbidden)? I know it can work in console mode if you format the command right |
Beta Was this translation helpful? Give feedback.
-
Edit: Nvm, I just saw the proinfo partition |
Beta Was this translation helpful? Give feedback.
-
|
@cxzstuff Can you send the flash tool that downloads RSA? |
Beta Was this translation helpful? Give feedback.
-
+1 Also, G24 has two flash tools on the firmware archive, that's weird |
Beta Was this translation helpful? Give feedback.
-
|
Both came with RSA. That v9 is the current one. I have also v4. Only difference between them is added c++ dll files. Also weird are those blankflash packages at lolinet. From were they got them? RSA doesn't offer them at the moment. Downloads just fastboot package, like for G31, G41. |
Beta Was this translation helpful? Give feedback.
-
What's also weird in your current one that it isn't at their secured server https://rsddownload-secure.lenovo.com like rest of the stuff. |
Beta Was this translation helpful? Give feedback.
-
|
"mrdump" Maybe this might come handy, from the name I'd say that it dumps memory. If it turns out right, it will surely be useful if we need to craft an exploit. I assume there's a fastboot command associated with it. |
Beta Was this translation helpful? Give feedback.
-
|
DA SLA keys for g24 got merged into mtkclient, now everyone can use it |
Beta Was this translation helpful? Give feedback.
-
|
We need to try to make the other DA file bypass SLA: I've found it in the flash tool. So the dl_forbidden has the seccfg blocked, and it worked beforehand. |
Beta Was this translation helpful? Give feedback.
-
|
@cxzstuff try adding this to the da_sla_keys: SlaKey(vendor="Generic",
da_codes=[],
name="SetRsaKey in libsla_challenge.so, secure_chip_tools/keys/toolauth/sla_prvk.pem V5",
d=17927221772803595589677548665100382532460666845948522915567191138741093137994346758223790428815724337119399848617323634517831321838857002928203340809368584412532275387119052050346117829587547335823645786993417933752612674263704610122642616766124615147357260453258785716304089937180892099709020291991047354911782870897115280093452505641278117790282224075714432226317608734573868880945885289415362825737676921878537194428184324625476692278084544343444435636989350942762677823240040394539138366047050728975383606379913663863336393801544062712098911021002990407295958911986185315713867112814558339220670999677054756992713,
# "8E02CDB389BBC52D5383EBB5949C895B0850E633CF7DD3B5F7B5B8911B0DDF2A80387B46FAF67D22BC2748978A0183B5B420BA579B6D847082EA0BD14AB21B6CCCA175C66586FCE93756C2F426C85D7DF07629A47236265D1963B8354CB229AFA2E560B7B3641DDB8A0A839ED8F39BA8C7CDB94104650E8C7790305E2FF6D18206F49B7290B1ADB7B4C523E10EBF53630D438EF49C877402EA3C1BD6DD903892FD662FBDF1DFF5D7B095712E58E728BD7F6A8B5621175F4C08EBD6143CDACD65D9284DFFECAB64F70FD63182E4981551522727A2EE9873D0DB78180C26553AD0EE1CAAA21BCEBC5A8C0B331FE7FD8710F905A7456AF675A04AF1118CE71E36C9",
n=24768553458927569182264098384414119743435748352122448536260714781483609591751565373536682899405420594113926591732550627920208945701553102158862914443419182389461952820609704105060261920473892479137225127905294215755138122340474523740015372088152395971589602157167092642340489980247161917120903612864283134792211128271400444531978419218384701537034538417051660863427537718871156919447450593998355621418942546492747019880888003141225040123766139214470940969962244251360705865766394055854812601692583755861695306804617391695946006993172614987479125081044934005567736503206356076476324144050995732879986002921180459717263,
# "C43469A95B143CDC63CE318FE32BAD35B9554A136244FA74D13947425A32949EE6DC808CDEBF4121687A570B83C51E657303C925EC280B420C757E5A63AD3EC6980AAD5B6CA6D1BBDC50DB793D2FDDC0D0361C06163CFF9757C07F96559A2186322F7ABF1FFC7765F396673A48A4E8E3296427BC5510D0F97F54E5CA1BD7A93ADE3F6A625056426BDFE77B3B502C68A18F08B470DA23B0A2FAE13B8D4DB3746255371F43306582C74794D1491E97FDE504F0B1ECAC9DDEF282D674B817B7FFA8522672CF6281790910378FEBFA7DC6C2B0AF9DA03A58509D60AA1AD6F9BFDC84537CD0959B8735FE0BB9B471104B458A38DF846366926993097222F90628528F",
e="010001"), I've copied it from the brom_sla_keys, but I can find this in g24 firmware too. Try using it for bypassing DA_SWSEC_2316_p325a.bin |
Beta Was this translation helpful? Give feedback.
-
|
It doesn't work. I'm thinking that for the other DA they use Online SLA. We know for sure that g24 version of spft is a login one, so probably that DA file is less forbidding. Can someone try to get network requests from the flash tool when it is performing DA SLA? |
Beta Was this translation helpful? Give feedback.
-
|
@cxzstuff can you try setting the "EnableLog" to true, and then use the console mode of the spft, and finally see if you get a log file here: |
Beta Was this translation helpful? Give feedback.
-
I tried to exploit proinfo for my own purposes on penangf and did not succeed |
Beta Was this translation helpful? Give feedback.
-
That's not a problem, I can do CNAME at any time |
Beta Was this translation helpful? Give feedback.
-
|
What subdomain lol |
Beta Was this translation helpful? Give feedback.
-
We're going to write documentation, right? We have subdomains for each device. |
Beta Was this translation helpful? Give feedback.
-
I tried too on g23, but even if at the end is mtk bootloader, they still can have different implementation (for example the fact g24 has an efuse partition which gets used by lk apparently). I'll try to see the dump of g24 @cxzstuff sent a while ago later, and see how proinfo differs from our |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 I want to try something with g24: if we dump the seccfg partition with mtkclient, we can try then flashing it with fastboot. I'm not sure if it'll work (probably not), but if it's the same file (thus same signature), what's stopping it from being flashed? Before asking the others to try this I want your opinion though. I know that messing with seccfg can result in a brick (I don't know if it's hardbrick or softbrick), so surely we might need to first understand how to parse it correctly. |
Beta Was this translation helpful? Give feedback.
-
|
Surely, I'd try doing this with safer partitions like vbmeta |
Beta Was this translation helpful? Give feedback.
-
|
Something to try is dumping vbmeta with mtkclient and use diff to find out if they're equal or not. If not, then we need to make mtkclient dump them correctly for sure |
Beta Was this translation helpful? Give feedback.
-
|
seccfg, it probably can be wiped if problems. If one still has access to device, that is.... |
Beta Was this translation helpful? Give feedback.
-
I won't risk seccfg right away tho, I remember seeing some error messages in g23 preloader complaining about not finding seccfg, and we don't have a verified one which we could flash back (basically a softbrick but unrecoverable). I want to be sure first, that's why trying vbmeta is safer |
Beta Was this translation helpful? Give feedback.
-
|
Anyway, g24 has mtk bootloader They just skinned it. The code is all the same, but at least they made it look cooler. (I wonder if we could skin g23 one) I'll check tomorrow, but I'm sure I'll find the same vulnerable memcpy function as g23, that doesn't check for destination size. @R0rt1z2 (sorry for always pinging you), generally what would having a vulnerable memcpy function mean when dealing with phones? Do you think this can be used to cause a buffer overflow? 🤔 |
Beta Was this translation helpful? Give feedback.
-
|
I need someone to try all the functions in mtkclient: peek, poke, da efuse etc... If we have access to memwrite (I highly doubt it, but who knows), the phone would hey unlocked 100% because we could bypass secure boot measures for sure |
Beta Was this translation helpful? Give feedback.
-
Then I might take a look at g22 soft later! So basically, we were lucky by having bad firmware after all |
Beta Was this translation helpful? Give feedback.
-
balboa didn't work ... |
Beta Was this translation helpful? Give feedback.
-
|
How did you get that dialog window? As for the username and password I think we might only have luck analyzing network traffic |
Beta Was this translation helpful? Give feedback.
-
It's one of those G22 dev tools... gave those options as default... |
Beta Was this translation helpful? Give feedback.
-
We need to investigate this further imo, and find what the rom name for g24 is too |
Beta Was this translation helpful? Give feedback.
-
|
It seems that from g24 and further, moto decided to give to this "Tinno" company the handling of spft, lamu (g15) has the same stuff and keys as g24 |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 @cxzstuff This is not even moto bootloader, this is "Tinno" bootloader $ strings lk.img | grep "tinno"
tinno_carrier_update
tinno_carrier_otp_flag_update
tinno_carrier_otp_record_update
tinno_sku_and_carrier_match
tinno_carrier_init
tinno_add_cmdline
tinno_add_bootconfig
tinno_wallpaper_update
tinno_wallpaper_init
tinno_ddr_get_vendor
tinno_ddr_get_type
tinno_ddr_get_size
tinno_dfmode_init
tinno_dualsim_update
tinno_siminfo_init
tinno_facmode_update
tinno_facmode_init
tinno_fastboot_ui
tinno_fastboot
tinno_hwid_map
tinno_gpios_read
tinno_main_init
tinno_mfd_init
tinno_partition_read
tinno_flash_get_vendor
tinno_flash_get_size
tinno_flash_get_type
tinno_partition_write
tinno_flash_info_init
tinno_proinfo_battery_sn
tinno_proinfo_imei
tinno_proinfo_init
tinno_proinfo_update
tinno_proinfo_carrier
tinno_commercial_device_force_lock
tinno_check_payjoy_flag
tinno_fastboot_auth
tinno_efuse_enable
%s tinno_rsa_verify is failed %s
tinno_rsa_verify
tinno_fdr_update
tinno_zerotouch_update
tinno_enterprise_init
tinno_swinfo_fingerprint
tinno_swinfo_service_build_sn_verify
tinno_swinfo_init
tinno_swinfo_builddate |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
This.. will be hard, but it will allow to unlock basically any other phone with this kind of bootloader i think (so g15 too for example) Though, we will need an exploit 100%, either BROM (impossible) or something else. There's no way to just unlock the bootloader because of efuses (it's funny because probably this doesn't even come from moto, but this Tinno company. They really needed someone else to find a way to restrict bootloader unlock) |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 100% confirmed that g24 does not have BROM: hard bricked g24 |
Beta Was this translation helpful? Give feedback.
-
At least on g23 they left JTAG points "more accessible" compared to what g24 needs, or at least from what I'm seeing. I guess we have ""easier repair"" They really fear people unlocking a bootloader and not actual problems like FRP bypass without even using a PC... |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
Similar.. no heat gun used but a can opener.. |
Beta Was this translation helpful? Give feedback.
-
yes, it's JTAG |
Beta Was this translation helpful? Give feedback.
-
Orig. source ?? IDK, but probably more so than that spanish forum that collects stuff here and there... |
Beta Was this translation helpful? Give feedback.
-
While I was awaiting for the g23 script to be tried, I Decompiled the g24 lk binary.
Funnily enough, it doesn't even require a key to unlock the bootloader, there's just this check for secure boot.
Basically, if this check wasn't in place, it could be unlocked as easily as a Google pixel (apart from the 7 days connection it needs for not graying out oem unlock).
The only way to bypass this is making an exploit for disabling secure boot or try flashing seccfg through mtkclient.
We know g24 DA has some kind of access to seccfg thanks to the release notes present.
I'd need for someone to extract the spft from RSA first to confirm (I downloaded the one I used from the firmware archive) and also confirm this method to bypass DA SLA https://github.com/orgs/moto-penangf/discussions/16#discussioncomment-12017551
WHAT WE TRIED:
Beta Was this translation helpful? Give feedback.
All reactions